CVE catalog
CVE-2014-2913
nagios-nrpe: CVE-2014-2913
- Severity
- Low
- Published
- Source
- [NVD] · [CVE record]
- EPSS
- 15.31% · Oct 25, 2026
Incomplete blacklist vulnerability in nrpe.c in Nagios Remote Plugin Executor (NRPE) 2.15 and earlier allows remote attackers to execute arbitrary commands via a newline character in the -a option to libexec/check_nrpe. NOTE: this issue is disputed by multiple parties. It has been reported that the vendor allows newlines as "expected behavior." Also, this issue can only occur when the administrator enables the "dont_blame_nrpe" option in nrpe.conf despite the "HIGH security risk" warning within the comments
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | nagios-nrpe | sid | 4.2.0-1 | fixed |
| Debian | nagios-nrpe | forky | 4.1.3-1 | fixed |
| Debian | nagios-nrpe | trixie | 4.1.3-1 | fixed |
| Debian | nagios-nrpe | bookworm | 4.1.0-1 | fixed |
| Opensuse | nrpe | tumbleweed | 4.0.3-3.5 | fixed |
| Suse | nrpe | linux enterprise server 12 sp5 | 2.15-6.6.1 | fixed |
| Suse | nrpe | linux enterprise server for sap applications 12 sp5 | 2.15-6.6.1 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | nagios-nrpe | source | sid | 2.15-1 | unimportant | Not reported | [745272] |
| Debian | nagios-nrpe | source | forky | 2.15-1 | unimportant | Not reported | [745272] |
| Debian | nagios-nrpe | source | trixie | 2.15-1 | unimportant | Not reported | [745272] |
| Debian | nagios-nrpe | source | bookworm | 2.15-1 | unimportant | Not reported | [745272] |
| Opensuse | nrpe | rpm | tumbleweed | 4.0.3-3.5 | Not reported | OPENSUSE-SU-2024:11099-1 | Not reported |
| Suse | nrpe | rpm | linux enterprise server 12 sp5 | 2.15-6.6.1 | Not reported | SUSE-SU-2024:1417-1 | Not reported |
| Suse | nrpe | rpm | linux enterprise server for sap applications 12 sp5 | 2.15-6.6.1 | Not reported | SUSE-SU-2024:1417-1 | Not reported |
OpenFactory catalog packages
[openSUSE Tumbleweed]
- [monitoring-plugins-nrpe]Unknown
Source package: [nrpe]
Details (1)
4.1.1-1.8· x86_64 · tumbleweedUnknown · Fixed:
4.0.3-3.5Version impact unknown
dsa · nrpe · opensuse · tumbleweed
- [nrpe-doc]Unknown
Source package: [nrpe]
Details (1)
4.1.1-1.8· noarch · tumbleweedUnknown · Fixed:
4.0.3-3.5Version impact unknown
dsa · nrpe · opensuse · tumbleweed
- [nrpe]Fixed
Source package: [nrpe]
Details (1)
4.1.1-1.8· x86_64 · tumbleweedFixed · Fixed:
4.0.3-3.5dsa · nrpe · opensuse · tumbleweed
[Debian 12 (Bookworm)]
- [nagios-nrpe-plugin]Fixed
Source package: [nagios-nrpe]
Details (2)
4.1.0-1+b1· amd64 · bookwormFixed · Fixed:
2.15-1dsa · nagios-nrpe · debian · bookworm; dsa · nagios-nrpe · debian · 12
4.1.0-1+b1· arm64 · bookwormFixed · Fixed:
2.15-1dsa · nagios-nrpe · debian · bookworm; dsa · nagios-nrpe · debian · 12
- [nagios-nrpe-server]Fixed
Source package: [nagios-nrpe]
Details (2)
4.1.0-1+b1· amd64 · bookwormFixed · Fixed:
2.15-1dsa · nagios-nrpe · debian · bookworm; dsa · nagios-nrpe · debian · 12
4.1.0-1+b1· arm64 · bookwormFixed · Fixed:
2.15-1dsa · nagios-nrpe · debian · bookworm; dsa · nagios-nrpe · debian · 12
[Debian 13 (Trixie)]
- [nagios-nrpe-plugin]Fixed
Source package: [nagios-nrpe]
Details (2)
4.1.3-1· amd64 · trixieFixed · Fixed:
2.15-1dsa · nagios-nrpe · debian · 13
4.1.3-1· arm64 · trixieFixed · Fixed:
2.15-1dsa · nagios-nrpe · debian · 13
- [nagios-nrpe-server]Fixed
Source package: [nagios-nrpe]
Details (2)
4.1.3-1· amd64 · trixieFixed · Fixed:
2.15-1dsa · nagios-nrpe · debian · 13
4.1.3-1· arm64 · trixieFixed · Fixed:
2.15-1dsa · nagios-nrpe · debian · 13
Observed:
References
- [https://ftp.suse.com/pub/projects/security/csaf/suse-su-2024_1417-1.json]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2014-2913]
- [https://osv.dev/vulnerability/SUSE-SU-2024:1417-1]
- [https://osv.dev/vulnerability/UBUNTU-CVE-2014-2913]
- [https://osv.dev/vulnerability/openSUSE-SU-2024:11099-1]
- [https://security-tracker.debian.org/tracker/CVE-2014-2913]
[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]